cc-safe-setup 29.8.0 → 30.0.4

package/examples/refusal-arrest-gate.sh

@@ -0,0 +1,248 @@
+#!/bin/bash
+# refusal-arrest-gate.sh — Block the next tool call if the assistant's prose
+# in the same turn explicitly refused that action ("I won't modify X",
+# "I'll skip X", "I'll preserve X") and the tool call contradicts the refusal.
+#
+# Sister hook to closure-word-verify-gate.sh. Both follow the same shape
+# (recognition-without-arrest from #60226): the model's own prose names what
+# it will and will not do, and the actual tool sequence is uncorrelated with
+# the naming. closure-word-verify-gate fires on positive-closure language;
+# this one fires on self-stated NEGATIVE action followed by the action.
+#
+# Solves: refusal-side dual of #60506. Examples observed in the wild:
+#   - #60475 — sub-agent stated it would preserve uncommitted work, then
+#              ran `git checkout -- <files>` against the other operator's
+#              unstaged edits.
+#   - #60506 — agent acknowledged the categorical native-React ban, then
+#              introduced a native React component on the next Write.
+#              Agent confirmed the i18n-only label rule, then hardcoded
+#              the label in the next Edit.
+#   - #60188 — fraction of 51 acknowledged-rule-violations followed
+#              refusal-shape syntax in the response stream.
+#
+# Design philosophy:
+#   The cluster's load-bearing observation: prose rules cannot be
+#   the load-bearing element of architectural guarantees. The load-
+#   bearing element has to live in the harness at the point of action.
+#   closure-word-verify-gate lives on Stop (session-terminal). This hook
+#   lives on PreToolUse (mid-turn) because refusal-side failures happen
+#   between the refusal statement and the next user prompt.
+#
+# False-positive control (three constraints, in order of importance):
+#   1. TARGET MATCH, not verb match: a refusal of "I'll skip the test step"
+#      only triggers if the next tool call's target IS the test step.
+#      "I'll skip X → tool call edits Y" does not trigger.
+#   2. CURRENT TURN ONLY: refusals from prior turns do not gate the
+#      current PreToolUse. Refusal scope = same-turn assistant prose.
+#   3. ASSISTANT-ORIGINATED ONLY: refusals inside a quoted user-prompt
+#      block are ignored (the agent reading back what the user said
+#      should not trigger the gate when the agent does X next).
+#
+# Related Issues:
+#   #60506 (@zean89,   2026-05-19) — first-person self-report
+#   #60226 (@suwayama, 2026-05-18) — recognition-without-arrest framework
+#   #60475                          — sub-agent git checkout data loss
+#   #60188 (@beq00000)              — 51 rule violations in one session
+#
+# TRIGGER: PreToolUse
+# MATCHER: "Edit|Write|Bash|MultiEdit"
+#
+# CONFIGURATION (environment variables):
+#   CC_REFUSAL_PATTERNS       default built-in — pipe-separated regex of
+#                                                  refusal phrases (capturing
+#                                                  group 1 = target words)
+#   CC_REFUSAL_GATE_DISABLE   set to "1" to disable the gate entirely
+#
+# USAGE (settings.json):
+#   {
+#     "hooks": {
+#       "PreToolUse": [{
+#         "matcher": "Edit|Write|Bash|MultiEdit",
+#         "hooks": [{
+#           "type": "command",
+#           "command": "~/.claude/hooks/refusal-arrest-gate.sh"
+#         }]
+#       }]
+#     }
+#   }
+
+set -uo pipefail
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-refusal-arrest-gate-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [refusal-arrest-gate]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
+[ "${CC_REFUSAL_GATE_DISABLE:-0}" = "1" ] && exit 0
+
+INPUT=$(cat 2>/dev/null || true)
+[ -z "$INPUT" ] && exit 0
+
+# Default refusal patterns. Each pattern's capturing group 1 extracts the
+# target (file, action, step name) that the agent stated it would not act on.
+# The regex is permissive on the target to handle the natural-language tail.
+DEFAULT_REFUSAL_PATTERNS='I (will not|won['"'"']?t|am not going to|wo n['"'"']?t) (modify|edit|change|touch|update|delete|remove|overwrite|push|commit|run|execute|create|write to|alter|patch|replace|drop|reset) ([A-Za-z0-9_./@\-]+)|I['"'"']?ll (skip|preserve|keep|leave|not touch|not modify|avoid|leave alone|not change|not edit) (the |an? )?([A-Za-z0-9_./@\-]+)|let me not (modify|edit|change|touch|update|delete|run) ([A-Za-z0-9_./@\-]+)|skipping (the )?([A-Za-z0-9_./@\-]+)|preserving (the )?([A-Za-z0-9_./@\-]+)'
+
+REFUSAL_PATTERNS="${CC_REFUSAL_PATTERNS:-$DEFAULT_REFUSAL_PATTERNS}"
+
+# PreToolUse input shape: { tool_name, tool_input, transcript (path or array) }
+TOOL_NAME=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+[ -z "$TOOL_NAME" ] && exit 0
+
+# Tool target extraction by tool type
+case "$TOOL_NAME" in
+    Write|Edit|MultiEdit)
+        TOOL_TARGET=$(printf '%s' "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
+        ;;
+    Bash)
+        TOOL_TARGET=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+        ;;
+    *)
+        # Non-instrumented tool — pass through.
+        exit 0
+        ;;
+esac
+
+[ -z "$TOOL_TARGET" ] && exit 0
+
+# Pull the assistant's most recent message text in this turn. The transcript
+# field in PreToolUse may be a file path (newer shapes) or inline.
+TRANSCRIPT_PATH=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+ASSISTANT_TEXT=""
+
+if [ -n "$TRANSCRIPT_PATH" ] && [ -f "$TRANSCRIPT_PATH" ]; then
+    # Read the last assistant message from JSONL transcript.
+    # Iterate from the bottom up, take the first message with role=assistant.
+    #
+    # Parse PER LINE with `fromjson?` rather than slurping the whole window
+    # with `jq -rs`. A single transcript line carrying a raw control char
+    # (U+0000-U+001F, e.g. an unescaped newline from a large tool-output or
+    # heredoc block) makes a slurp fail outright ("control characters ... must
+    # be escaped"), which would empty ASSISTANT_TEXT and silently fail the gate
+    # open exactly when the transcript is large/messy. fromjson? drops only the
+    # unparseable line; -c keeps each assistant message as one JSON object so we
+    # can take the most-recent (first after tac) and still preserve multi-line
+    # text. See anthropics/claude-code#68665.
+    ASSISTANT_TEXT=$(tac "$TRANSCRIPT_PATH" 2>/dev/null \
+        | jq -cR 'fromjson? | select(.message.role == "assistant" or .role == "assistant")' 2>/dev/null \
+        | head -n 1 \
+        | jq -r '
+            (.message.content // .content // empty)
+            | if type == "array" then map(select(.type == "text") | .text) | join("\n") else . end
+        ' 2>/dev/null \
+        || true)
+fi
+
+# Fallback inline shapes.
+if [ -z "$ASSISTANT_TEXT" ]; then
+    ASSISTANT_TEXT=$(printf '%s' "$INPUT" | jq -r '
+        .last_assistant_message //
+        .assistant_message //
+        .turn_assistant_text //
+        empty
+    ' 2>/dev/null)
+fi
+
+[ -z "$ASSISTANT_TEXT" ] && exit 0
+
+# Strip quoted user-prompt blocks (lines starting with "> " in markdown,
+# or text inside <user_prompt>/<quoted-prompt> tags). Refusals quoted from
+# the user must not trigger the gate when the agent does X next.
+FILTERED_TEXT=$(printf '%s' "$ASSISTANT_TEXT" \
+    | sed -e 's/<user_prompt>[^<]*<\/user_prompt>//g' \
+          -e 's/<quoted-prompt>[^<]*<\/quoted-prompt>//g' \
+    | grep -v '^>' \
+    || true)
+
+[ -z "$FILTERED_TEXT" ] && exit 0
+
+# Match refusal patterns against the filtered text. Pull every matching
+# refusal-target word into a candidate list. Strip trailing punctuation
+# (period, comma, semicolon, colon) so that "config.json." in prose matches
+# "config.json" in the tool target.
+REFUSAL_TARGETS=$(printf '%s' "$FILTERED_TEXT" \
+    | grep -Eio "$REFUSAL_PATTERNS" \
+    | sed -E 's/^(I (will not|won.?t|am not going to|wo n.?t) (modify|edit|change|touch|update|delete|remove|overwrite|push|commit|run|execute|create|write to|alter|patch|replace|drop|reset)) //I; s/^(I.?ll (skip|preserve|keep|leave|not touch|not modify|avoid|leave alone|not change|not edit)) (the |an? )?//I; s/^(let me not (modify|edit|change|touch|update|delete|run)) //I; s/^(skipping|preserving) (the )?//I' \
+    | tr -s ' ' '\n' \
+    | sed -E 's/[.,;:!?]+$//' \
+    | grep -vE '^(the|a|an|to|and|or|that|this|file|files|step|steps)$' \
+    | sort -u)
+
+[ -z "$REFUSAL_TARGETS" ] && exit 0
+
+# For each refusal target, check whether it appears in the tool target.
+# Match is substring-of-basename for file paths, substring-of-command
+# for Bash. Case-insensitive.
+TOOL_TARGET_LC=$(printf '%s' "$TOOL_TARGET" | tr '[:upper:]' '[:lower:]')
+
+# For Write/Edit, also try the basename in case the refusal mentioned only
+# the filename without the path.
+if [ "$TOOL_NAME" != "Bash" ]; then
+    TOOL_BASENAME=$(basename "$TOOL_TARGET" 2>/dev/null | tr '[:upper:]' '[:lower:]')
+else
+    TOOL_BASENAME=""
+fi
+
+MATCHED_TARGET=""
+while IFS= read -r target; do
+    [ -z "$target" ] && continue
+    target_lc=$(printf '%s' "$target" | tr '[:upper:]' '[:lower:]')
+    # Skip very short targets to avoid spurious matches.
+    [ "${#target_lc}" -lt 3 ] && continue
+
+    if [ "$TOOL_NAME" = "Bash" ]; then
+        # For Bash, match the refusal target against any token in the command.
+        if printf '%s' "$TOOL_TARGET_LC" | grep -Fq "$target_lc"; then
+            MATCHED_TARGET="$target"
+            break
+        fi
+    else
+        # For Write/Edit/MultiEdit, match against path or basename.
+        if printf '%s' "$TOOL_TARGET_LC" | grep -Fq "$target_lc" \
+            || ([ -n "$TOOL_BASENAME" ] && printf '%s' "$TOOL_BASENAME" | grep -Fq "$target_lc"); then
+            MATCHED_TARGET="$target"
+            break
+        fi
+    fi
+done <<<"$REFUSAL_TARGETS"
+
+[ -z "$MATCHED_TARGET" ] && exit 0
+
+# Refusal target matched the tool target. Surface the contradiction.
+cat >&2 <<EOF
+<system-reminder>
+REFUSAL-SIDE ARREST — your assistant prose in this turn stated that you would
+not act on "$MATCHED_TARGET", and the next tool call is $TOOL_NAME against
+a target that contains "$MATCHED_TARGET":
+
+  tool:    $TOOL_NAME
+  target:  $TOOL_TARGET
+  refusal: "$MATCHED_TARGET" (matched from your same-turn prose)
+
+This is the refusal-side dual of the failure mode in #60506 and #60475:
+the model's prose names what it will not do, and the actual tool sequence
+contradicts the naming. The cost of an unverified refusal-then-action
+contradiction lands on the operator, not on the model.
+
+Before proceeding, either:
+
+  1. Acknowledge the contradiction explicitly in the next turn, state
+     the reason the action is now correct, and re-issue the tool call
+     with the reason in the same turn, OR
+  2. Restate the refusal as conditional ("I'll not modify $MATCHED_TARGET
+     unless <condition>"), satisfy the condition, then proceed.
+
+To disable this gate intentionally (for retrospectives, plans, documentation
+turns that quote intentions without executing them), set
+CC_REFUSAL_GATE_DISABLE=1 in your environment.
+</system-reminder>
+EOF
+
+exit 2

package/examples/registry-publish-guard.sh

@@ -17,7 +17,19 @@
 #   docker push           (Docker Hub)
 #   helm push             (Helm charts)
 #
-# TRIGGER: PreToolUse  MATCHER: "Bash"
+# TRIGGER: PreToolUse  MATCHER: "Bash|PowerShell"
+
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-registry-publish-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [registry-publish-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
 
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)

package/examples/remote-control-billing-classifier.sh

@@ -0,0 +1,135 @@
+#!/bin/bash
+# ================================================================
+# remote-control-billing-classifier.sh — Warn at session start when
+#   the parent process tree includes `claude remote-control`, so
+#   the operator knows the spawned `claude --print` child will draw
+#   from the new Agent SDK monthly credit (Pool 2) starting June 15,
+#   2026, separate from interactive usage limits.
+# ================================================================
+# PURPOSE:
+#   Issue #59823 documents the implementation detail that
+#   `claude remote-control` spawns one `claude --print --sdk-url …`
+#   child per session. The June 15, 2026 billing split routes
+#   `claude --print` and Agent SDK usage to a new "automation
+#   bucket" (Pool 2) on Pro $20 / Max 5x $100 / Max 20x $200 plans,
+#   separate from interactive Claude Code usage. The documentation
+#   does not yet classify `claude remote-control` itself, so
+#   operators running automation through it can silently double-
+#   consume Pool 2 once the cliff lands.
+#
+#   This hook reads the process tree at session start. When any
+#   ancestor command line matches `claude remote-control`, it emits
+#   a one-line stderr advisory naming the Pool 2 implication and
+#   pointing to the two operator-side audits worth running before
+#   June 15. Advisory only (exit 0); does not block the session.
+#
+# TRIGGER: SessionStart
+# MATCHER: ""
+#
+# UPSTREAM:
+#   #59823 [DOCS] Billing implications for `claude remote-control`
+#          on June 15th (Pool 2 classification of the child
+#          `claude --print` process is undocumented as of 2026-05-28)
+#
+# SETUP:
+#   {
+#     "hooks": {
+#       "SessionStart": [
+#         {
+#           "matcher": "",
+#           "hooks": [
+#             { "type": "command",
+#               "command": "$HOME/.claude/hooks/remote-control-billing-classifier.sh" }
+#           ]
+#         }
+#       ]
+#     }
+#   }
+#
+# BEHAVIOR:
+#   - No `claude remote-control` ancestor → silent pass.
+#   - Ancestor found → stderr advisory + exit 0 (does not block).
+#
+# CONFIGURATION (env vars):
+#   CC_REMOTE_CONTROL_DISABLE          Set to "1" to disable the hook.
+#   CC_REMOTE_CONTROL_PROCESS_OVERRIDE Comma-separated cmdlines to scan
+#                                      instead of live `ps` output.
+#                                      Used by tests; also lets CI
+#                                      simulate a remote-control parent.
+#   CC_REMOTE_CONTROL_PATTERN          Override the cmdline regex
+#                                      (default: "claude remote-control").
+# ================================================================
+
+set -u
+
+if [ "${CC_REMOTE_CONTROL_DISABLE:-0}" = "1" ]; then
+    exit 0
+fi
+
+PATTERN="${CC_REMOTE_CONTROL_PATTERN:-claude remote-control}"
+
+# Read stdin (SessionStart JSON payload) but do not require its shape.
+# The hook only inspects the process tree, not the payload.
+if [ ! -t 0 ]; then
+    cat >/dev/null 2>&1 || true
+fi
+
+# Gather candidate cmdlines: either the override (for tests) or
+# the live ancestor process tree via `ps`.
+CMDLINES=""
+if [ -n "${CC_REMOTE_CONTROL_PROCESS_OVERRIDE:-}" ]; then
+    CMDLINES="$CC_REMOTE_CONTROL_PROCESS_OVERRIDE"
+else
+    # Walk parent PIDs upward and collect cmdlines. We avoid `ps
+    # --forest` because BusyBox does not implement it; instead we
+    # follow PPID via /proc when available, falling back to ps -p.
+    PID=$$
+    DEPTH=0
+    while [ "$PID" != "1" ] && [ "$DEPTH" -lt 20 ]; do
+        if [ -r "/proc/$PID/cmdline" ]; then
+            CMD=$(tr '\0' ' ' < "/proc/$PID/cmdline" 2>/dev/null)
+            CMDLINES="${CMDLINES}${CMD}
+"
+            PPID=$(awk '/^PPid:/ {print $2}' "/proc/$PID/status" 2>/dev/null)
+        else
+            CMD=$(ps -o args= -p "$PID" 2>/dev/null)
+            CMDLINES="${CMDLINES}${CMD}
+"
+            PPID=$(ps -o ppid= -p "$PID" 2>/dev/null | tr -d ' ')
+        fi
+        if [ -z "$PPID" ] || [ "$PPID" = "$PID" ]; then
+            break
+        fi
+        PID="$PPID"
+        DEPTH=$((DEPTH+1))
+    done
+fi
+
+# Look for the pattern in any candidate cmdline.
+if printf '%s' "$CMDLINES" | grep -q -- "$PATTERN"; then
+    cat >&2 <<EOF
+
+⚠️  Session started under \`claude remote-control\`.
+
+   Starting 2026-06-15, the child \`claude --print --sdk-url …\`
+   process that remote-control spawns will draw from the new
+   Agent SDK monthly credit (Pool 2), separate from interactive
+   Claude Code usage. The documentation does not yet classify
+   \`claude remote-control\` itself (see issue #59823), so
+   automation that drives sessions through it can silently
+   consume Pool 2 once the cliff lands.
+
+   Two pre-June-15 audits worth running:
+     1. \`ps --forest -p \$(pgrep -f 'claude remote-control')\`
+        — confirm the children you expect, no stray sessions.
+     2. Open https://support.claude.com/en/articles/15036540
+        and verify the one-time Agent SDK opt-in is pressed
+        for the account that owns the remote-control server.
+
+   This is an advisory; the session continues.
+   Set CC_REMOTE_CONTROL_DISABLE=1 to silence.
+
+EOF
+fi
+
+exit 0

package/examples/replace-all-guard.sh

@@ -33,6 +33,18 @@
 
 set -u
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-replace-all-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [replace-all-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 
 REPLACE_ALL=$(printf '%s' "$INPUT" | jq -r '.tool_input.replace_all // false' 2>/dev/null)

package/examples/repo-visibility-guard.sh

@@ -14,6 +14,18 @@
 #   }
 # }
 
+# Without jq, the parse below silently yields empty and this hook stops
+# guarding - with no error anywhere. Say so. We deliberately do not exit
+# here: blocking would halt every tool call, and exiting 0 would change
+# the behaviour of guards that do not depend on the parsed value.
+if ! command -v jq >/dev/null 2>&1; then
+  _nojq_warned="/tmp/cc-nojq-warned-repo-visibility-guard-$PPID"
+  [ -f "$_nojq_warned" ] || {
+    echo "WARNING [repo-visibility-guard]: jq not found - this hook cannot inspect tool calls and is NOT protecting you. Install jq." >&2
+    : > "$_nojq_warned"
+  }
+fi
+
 INPUT=$(cat)
 COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
 [ -z "$COMMAND" ] && exit 0

package/examples/reroute-after-block-guard.sh

@@ -0,0 +1,150 @@
+#!/bin/bash
+# ================================================================
+# reroute-after-block-guard.sh — Stop "reroute after a block"
+# ================================================================
+# PURPOSE:
+#   PreToolUse hooks are stateless: each one evaluates the current
+#   action in isolation, with no memory that a sibling action was
+#   just denied. So a common failure trajectory slips through —
+#   a gate fires on an action, the agent substitutes an equivalent
+#   path toward the SAME target, and the next hook sees a fresh,
+#   individually-defensible action and lets it run.
+#   (anthropics/claude-code#70112: "Agent treats safety gates as
+#    obstacles to route around" — goal misgeneralization.)
+#
+#   This hook adds the missing state. It reads the transcript: if
+#   the PREVIOUS tool call was blocked by a PreToolUse hook and the
+#   CURRENT action targets the same concrete FILE/path, it stops and
+#   surfaces to the human instead of letting the reroute proceed. A
+#   fired gate should RAISE the threshold for proceeding, not prompt
+#   a search for another path.
+#
+#   This does not change the model's disposition; it converts a
+#   silent reroute into a hard stop for the case where the blast
+#   radius is concentrated on one target (a file, a path).
+#
+# Detects (only when ALL hold, else it stays out of the way):
+#   1. the most recent tool result is an error, AND
+#   2. its text is a Claude Code PreToolUse hook block
+#      (the "PreToolUse: ... hook error" runner phrasing), AND
+#   3. the blocked action and the current action share a concrete
+#      filesystem path (anchored path or a path with a file
+#      extension). Bare word/word tokens and git refs (origin/main,
+#      refs/heads/...) are NOT treated as targets — inspecting a
+#      branch after a push is rejected must stay allowed.
+#
+# Does NOT block (fail-open by design — never guesses):
+#   - no transcript available / unreadable / jq missing
+#   - previous tool succeeded (no gate fired)
+#   - the error was a normal failure or a server-side rejection
+#     ("permission denied", git "blocked by required reviews", etc.)
+#   - no shared concrete file/path between blocked and current action
+#   - the human explicitly re-authorizes with CC_REROUTE_ALLOW=1
+#
+# Legitimate retry after fixing the real problem is expected: set
+#   CC_REROUTE_ALLOW=1 for that one command. Being forced to do so
+#   IS the point — it makes "proceed after a block" a conscious act.
+#
+# NOTE: this hook deliberately omits `set -e`/`pipefail`. Every
+#   jq/tail/grep failure must fall through to the next
+#   `[ -z "$VAR" ] && exit 0` guard; a crash exit (1) would be
+#   miscounted by Claude Code as a hook error rather than "allow".
+#
+# TRIGGER: PreToolUse  MATCHER: "Bash|Edit|Write|MultiEdit"
+#
+# CONFIG:
+#   CC_REROUTE_ALLOW=1     one-shot override (proceed despite block)
+#   CC_REROUTE_DISABLE=1   disable this hook entirely
+# ================================================================
+
+[ "${CC_REROUTE_DISABLE:-0}" = "1" ] && exit 0
+[ "${CC_REROUTE_ALLOW:-0}" = "1" ] && exit 0
+
+command -v jq >/dev/null 2>&1 || exit 0
+
+INPUT=$(cat)
+
+TP=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+[ -z "$TP" ] && exit 0
+TP="${TP/#\~/$HOME}"
+[ -r "$TP" ] || exit 0
+
+# Current action's concrete target (command string or edited file).
+CUR=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // .tool_input.file_path // empty' 2>/dev/null)
+[ -z "$CUR" ] && exit 0
+
+# Only the tail matters: a blocked tool_use and its result are adjacent
+# and most recent. Bound the work so the hook stays cheap.
+WINDOW=$(tail -n 120 "$TP" 2>/dev/null)
+[ -z "$WINDOW" ] && exit 0
+
+# Most recent tool_result: {id, err, text}. Parse each line independently with
+# `try fromjson catch empty` so one malformed line can't abort the scan and
+# leave us reading a stale (older) result. content may be string or array.
+LAST=$(printf '%s' "$WINDOW" \
+  | jq -Rc 'try (fromjson) catch empty
+           | select(.message.content? != null) | .message.content[]?
+           | select(.type=="tool_result")
+           | {id: .tool_use_id,
+              err: (.is_error // false),
+              text: (.content
+                     | if type=="array" then (map(.text? // "") | join(" "))
+                       elif type=="string" then .
+                       else "" end)}' 2>/dev/null | tail -n 1)
+[ -z "$LAST" ] && exit 0
+
+ERR=$(printf '%s' "$LAST" | jq -r '.err // false' 2>/dev/null)
+[ "$ERR" = "true" ] || exit 0
+
+TEXT=$(printf '%s' "$LAST" | jq -r '.text // ""' 2>/dev/null)
+# Was the previous action stopped by a Claude Code PreToolUse hook? Match ONLY
+# the hook runner's own phrasing ("PreToolUse: <matcher> hook error"). Generic
+# "permission denied" / git "blocked by ..." server rejections are NOT gates —
+# matching them would false-block ordinary post-failure work.
+printf '%s' "$TEXT" | grep -qE 'PreToolUse:[^|]*hook error' || exit 0
+
+BLOCKED_ID=$(printf '%s' "$LAST" | jq -r '.id // empty' 2>/dev/null)
+[ -z "$BLOCKED_ID" ] && exit 0
+
+# The blocked action's concrete target, linked by tool_use_id.
+BLOCKED=$(printf '%s' "$WINDOW" \
+  | jq -Rr --arg id "$BLOCKED_ID" 'try (fromjson) catch empty
+          | select(.message.content? != null) | .message.content[]?
+          | select(.type=="tool_use" and .id==$id)
+          | (.input.command // .input.file_path // empty)' 2>/dev/null | tail -n 1)
+[ -z "$BLOCKED" ] && exit 0
+
+# Shared concrete file/path? Pull slash-bearing tokens from the blocked action,
+# keep only real filesystem paths (anchored with / ./ ../ ~/, or carrying a file
+# extension), drop flags and git refs, and look for any in the current action.
+# A file/path overlap is the strong, low-false-positive signal that the agent is
+# rerouting toward the same resource rather than doing unrelated work.
+SHARED=""
+while IFS= read -r tok; do
+    [ -z "$tok" ] && continue
+    case "$tok" in
+        -*) continue ;;                                                   # flag
+        origin/*|upstream/*|remotes/*|refs/*|heads/*|tags/*) continue ;;  # git refs
+    esac
+    [ "${#tok}" -lt 4 ] && continue
+    case "$tok" in
+        /*|./*|../*|~/*) : ;;   # anchored filesystem path
+        *.*) : ;;               # carries a file extension
+        *) continue ;;          # bare word/word (e.g. origin/main) — not a target
+    esac
+    if printf '%s' "$CUR" | grep -qF -- "$tok"; then
+        SHARED="$tok"
+        break
+    fi
+done < <(printf '%s' "$BLOCKED" | grep -oE '(/|\./|\.\./|~/)?[A-Za-z0-9_.-]+(/[A-Za-z0-9_.+-]+)+')
+
+[ -z "$SHARED" ] && exit 0
+
+cat >&2 <<MSG
+ブロック: 直前の操作はゲート(PreToolUseのhook)で止められました。
+今回の操作は同じ対象「${SHARED}」へ向かう再ルートに見えます。
+ゲートの発火は「別の経路を探せ」ではなく「立ち止まって正しさを確かめろ」の合図です。
+回避策を探さず、人へ状況を共有してください。
+本当に正しいと確認した上で進めるなら、その1コマンドだけ CC_REROUTE_ALLOW=1 を付けて実行してください。
+MSG
+exit 2

package/examples/resume-drift-watcher.sh

@@ -0,0 +1,57 @@
+#!/bin/bash
+# resume-drift-watcher.sh — resume attachment relocation detector (Incident 2)
+# Why: v2.1.69–v2.1.89 had a bug where --resume would relocate the original
+#      attachment payload out of messages[0] and into a later turn. The bug
+#      was marked fixed but residual drift still shows a tiny messages[0]
+#      (~350 bytes) when a resumed session is working correctly. A session
+#      with drifted attachments shows a very small messages[0] followed by
+#      disproportionately large messages[N] entries.
+# Event: PostToolUse  MATCHER: "*"
+# Action: Per turn, record first-message byte length and total-message byte
+#         length to ~/.claude/logs/resume-drift.log. Compare manually: a
+#         session started with --resume whose messages[0] is much smaller
+#         than a fresh session's is a drift candidate.
+#
+# Review with:
+#   awk -F'\t' '$3<500 && $4>50000 {print}' ~/.claude/logs/resume-drift.log
+
+set -u
+
+LOG_DIR="${HOME}/.claude/logs"
+LOG_FILE="${LOG_DIR}/resume-drift.log"
+mkdir -p "$LOG_DIR" 2>/dev/null
+
+INPUT=$(cat)
+
+SESSION_ID=$(printf '%s' "$INPUT" | jq -r '.session_id // "unknown"' 2>/dev/null)
+TRANSCRIPT=$(printf '%s' "$INPUT" | jq -r '.transcript_path // empty' 2>/dev/null)
+
+if [ -z "$TRANSCRIPT" ] || [ ! -r "$TRANSCRIPT" ]; then
+  exit 0
+fi
+
+# First message — scan from top; stop at first user message.
+FIRST_MSG=$(grep -m1 '"role":"user"' "$TRANSCRIPT" 2>/dev/null || true)
+FIRST_LEN=$(printf '%s' "$FIRST_MSG" | wc -c | tr -d ' ')
+
+# Total body size = file size of the transcript itself. This is a conservative
+# proxy for request-body size: a resumed session with many large intermediate
+# messages will have a large transcript.
+TOTAL_LEN=$(wc -c < "$TRANSCRIPT" 2>/dev/null | tr -d ' ')
+TOTAL_LEN="${TOTAL_LEN:-0}"
+
+TURN_COUNT=$(grep -c '"role":' "$TRANSCRIPT" 2>/dev/null || echo 0)
+
+TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+printf '%s\t%s\t%s\t%s\t%s\n' \
+  "$TS" "$SESSION_ID" "$FIRST_LEN" "$TOTAL_LEN" "$TURN_COUNT" \
+  >> "$LOG_FILE"
+
+# Only emit a stderr warning after turn 2 (per Appendix B: "Only investigate
+# after the first two turns of a resumed session"). Threshold: first-user
+# message under 500 bytes while total already exceeds 50 KB = drift candidate.
+if [ "$TURN_COUNT" -gt 4 ] && [ "$FIRST_LEN" -lt 500 ] && [ "$TOTAL_LEN" -gt 50000 ]; then
+  echo "⚠ resume-drift signal: messages[0]=${FIRST_LEN}B / total=${TOTAL_LEN}B (see #43278)" >&2
+fi
+
+exit 0